Argh! Found a #vulnerability in a big #OpenSource product.
No security.txt
No private issues on GitHub
No bug bounty listed
So I guess I can either raise a public issue on GitHub or email their tech support team.
Any other ideas?
Found the developer's email after raising a vague issue on GitHub and stalking their LinkedIn.
Vulnerability report accepted. Don't think there's a bug bounty, sadly.
Write up coming next month.
I've never had a successful bug bounty. From what I've heard from others- it's a pipe dream.
So I see, but not enough to make a living :P as many have often believed possible.
Although, if your cost of living is immensely small- it still is...
@lucifargundam I mean, I'm not doing it full time!
You can check out the leaderboards on HackerOne etc - plenty of people making money. But they are treating it as a full-time job.
@lucifargundam I've had several. https://shkspr.mobi/blog/tag/bug-bounty/